Remote Client & Vendor Risk Manager, InfoSec & Compliance

Baker Botts LLP; Dallas, Northern (TX, KY); Hybrid; USD 140,000 - 200,000; Full time

Job summary

Baker Botts LLP in the United States is seeking an Information Security Client & Vendor Risk Manager to oversee the firm’s client due diligence and third-party risk vetting. You will be SME on information-security controls, coordinate with IT Security, Procurement, and OGC, and prepare for audits and regulatory reviews while mentoring junior analysts.

The role is fully remote with periodic on-site meetings and travel as needed, interfacing with senior clients and partners in a high-regulation

Qualifications

• Deep understanding of security frameworks and standards (SOC 2, ISO 27001, NIST CSF, HIPAA, GLBA, state privacy laws).
• Experience conducting or leading vendor-risk assessments for enterprise providers.
• Strong communication skills to brief partners and translate technical concepts.

Responsibilities

• Own and mature the firm‑wide client and vendor due‑diligence program.
• Serve as the firm’s SME on information‑security controls and risk posture.
• Lead complex vendor‑risk assessments for high‑impact providers.
• Develop and maintain the vendor‑risk management framework and onboarding workflows.
• Partner with Procurement, IT, and OGC to evaluate vendor contracts and risk mitigation.
• Prepare the firm for client audits and regulatory reviews and coordinate evidence collection.
• Represent the firm in client‑facing security discussions with counsel and client teams.
• Monitor regulatory developments relevant to the legal industry.

Skills

Security frameworks

Communication

Cross-functional leadership

Education

Certifications such as CTPRA / ISO 27001 Lead Implementer or Lead Auditor / CISSP, CISM, CRISC, CISA

Tools

DMS

e‑discovery platforms

cloud‑based practice‑management tools

Job description

Baker Botts LLP in the United States is seeking an Information Security Client & Vendor Risk Manager to oversee the firm’s client due diligence and third-party risk vetting. You will be SME on information-security controls, coordinate with IT Security, Procurement, and OGC, and prepare for audits and regulatory reviews while mentoring junior analysts.

The role is fully remote with periodic on-site meetings and travel as needed, interfacing with senior clients and partners in a high-regulation